Logs
| where Timestamp between(datetime(2014-03-08 03:00:00) .. 1h)
| where * has 'Internal'
| top 1000 by Timestamp